← Blog

AWS Lambda — Automate Analyzing your Permissions using IAM Access Advisor

January 5, 2023

Over-permissioned IAM roles are a common security gap. This post walks through automating the detection of unused permissions with Lambda and the IAM Access Advisor APIs — flagging IAM roles with services not accessed for more than 90 days.

Components

• AWS Lambda (Python 3.x runtime)
• AWS IAM (Access Advisor APIs)
• AWS SES for email notifications

Core APIs

• generate_service_last_accessed_details — kicks off a job generating service access data, returning a JobId
• get_service_last_accessed_details — retrieves the service access data using that JobId

IAM permissions the Lambda execution role needs

• iam:GenerateServiceLastAccessedDetails
• iam:GetServiceLastAccessedDetails
• iam:ListRoles
• ses:SendEmail and ses:SendRawEmail
• CloudWatch Logs permissions

Workflow

1. Lambda retrieves all IAM roles in the account.
2. For each role, it generates access details and polls until the job completes.
3. Services unused for more than 90 days get collected.
4. Results are formatted into an HTML table and emailed out.

A couple of things worth knowing going in: Lambda’s timeout should be set to at least a few minutes, since AWS can take a while to process these jobs, and you’ll need verified SES email addresses plus an up-to-date boto3 in your deployment package.